The "buggy" admin_urls ( a,x,in) doesn't exist in blesta. Anyway, blesta should have a validation in place.
There are pro and cons security throughobscurity.
From my point of view, anyway I shall restrict by IP the admin url. I just love the idea of having one letter admin_url. It's fast and fun.